Trello Power-Up SDK allowedOrigins enforcement gap in local development

The Trello Power-Up SDK lets developers configure an iframe URL for the capability interface, and the optional allowedOrigins property is documented as a security control that restricts which domains may embed that iframe. In local development environments, however, the SDK does not appear to enforce this list, and omitting the field leaves the Power-Up loadable from any origin without a runtime warning or error.

This creates uncertainty for teams building Power-Ups on localhost or tunneled domains: it is unclear whether the origin check is intentionally deferred to production, silently ignored in development mode, or simply unvalidated until a later stage. Without knowing the exact boundary, a developer may unknowingly publish a Power-Up that accepts frames from arbitrary domains, exposing the interface to clickjacking or data leakage.

Where does the SDK draw the line between development and production enforcement of allowedOrigins, and what is the expected behavior when the list is absent during local embedding?